             issuer root-cert
             issuer-key-pair root-key-pair]
        (if (< certs-to-generate 1)
-         [certs crls]
+         [certs crls issuer-key-pair]
          (let [[new-cert new-key-pair] (generate-ca-cert
                                         (cn (get-cn-from-x509-certificate issuer))
                                         issuer-key-pair

  (if (< number-of-certs 2)
    (throw (Exception. (format "Can't perform revocations on a %d-cert chain."
                               number-of-certs))))
  (let [key-pair (generate-key-pair 2048)
        [certs crls] (generate-cert-chain-with-crls number-of-certs
                                                    generate-crl
                                                    key-pair)
        cert-to-revoke (nth certs (- number-of-certs 2))
        crl-to-update (last crls)
        updated-crl (revoke crl-to-update
                            (get-private-key key-pair)
                            (get-public-key key-pair)
                            (get-serial cert-to-revoke))]
    [certs (-> crls drop-last (conj updated-crl))]))

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; Writing test files

  [number-of-certs test-subpath]
  (let [certs-filename (str number-of-certs "-cert-chain.pem")
        crls-filename (str number-of-certs "-crl-chain.pem")
        [certs crls _] (generate-cert-chain-with-crls number-of-certs)]
    (write-certs-and-crls certs crls test-subpath certs-filename crls-filename)))

(defn write-expired-crl
  [test-subpath]
  (let [cert-filename "cert-with-expired-crl.pem"
        crl-filename "expired-crl.pem"
        [cert expired-crl _] (generate-cert-chain-with-crls 1 generate-expired-crl)]
    (write-certs-and-crls cert expired-crl test-subpath cert-filename crl-filename)))

(defn write-not-yet-valid-crl
  [test-subpath]
  (let [cert-filename "cert-with-not-valid-crl.pem"
        crl-filename "not-yet-valid-crl.pem"
        [cert crl _] (generate-cert-chain-with-crls 1 generate-not-yet-valid-crl)]
    (write-certs-and-crls cert crl test-subpath cert-filename crl-filename)))

(defn write-crl-with-bad-sig
  [test-subpath]
  (let [cert-filename "cert-with-crl-bad-sig.pem"
        crl-filename "crl-with-bad-signature.pem"
        [cert bad-crl _] (generate-cert-chain-with-crls 1 generate-crl-with-bad-signature)]
    (write-certs-and-crls cert bad-crl test-subpath cert-filename crl-filename)))

(defn write-cert-chain-with-revoked-cert
